merge-script a42da819a9 Merge bitcoin/bitcoin#36174: http: throttle send buffer when client stops draining ...

28b69e2988 http: stop processing requests from a client when send buffer is full (Matthew Zipkin)

Pull request description:

  This is a follow-up to #36123 and applies a second throttle mechanism to the send-side. If a misbehaving client refuses to read data from the socket, the server will now stop processing requests instead of packing more and more responses to `m_send_buffer` without bound.

  After we parse a complete request from a client, **before** we dispatch it to a worker, we quickly lock and check the size of `m_send_buffer`. If there's already 32MiB of data there (reusing `MAX_BODY_SIZE` here, open for bikeshedding...) we do not dispatch the request to a worker, leaving it in place as `m_req`.

  This was found and disclosed responsibly by the Red Team 🟥.

ACKs for top commit:
  hodlinator:
    ACK 28b69e2988
  janb84:
    re ACK 28b69e2988
  sedited:
    ACK 28b69e2988

Tree-SHA512: ecefdf6406fa40aa28fe284fd4b5a148a0e4ef84b857e373cc7a55c84bac5c7a928b09c088d9ebe5a2adadfbd95a5ae1644f024947ed891da067130d1aa84ae6

2026-09-10 14:27:09 +02:00

38 KiB

Executable File

Raw Blame History

View Raw